ForceBridge
Summary
ForceBridge is a cross-chain bridge operated by Magickbase on the Nervos Network (CKB), enabling transfers between Nervos and Ethereum and BNB Chain. On June 2, 2025, the bridge was exploited via an access control vulnerability — likely a compromised private key — resulting in approximately $3.7–3.9 million in user funds being stolen and laundered through Tornado Cash. The exploit occurred just one day after Magickbase announced the bridge's sunset, raising questions about the timing and origin of the attack.
Connected Entities
1 entitiesTimeline(8 events)
2021-10-14
ForceBridge launches on Nervos Network mainnet, enabling cross-chain transfers between CKB, Ethereum, Cardano, and Polkadot.
2025-05-31
Magickbase announces the sunset of ForceBridge and Godwoken, citing low user activity and high maintenance costs. Six-month withdrawal window announced.
2025-06-02
ForceBridge exploited via access control vulnerability (likely compromised private key). Approximately $3.7–3.9 million in ETH, USDC, USDT, DAI, and WBTC stolen across Ethereum and BNB Chain.
2025-06-02
Cyvers Alerts first detects and reports suspicious activity involving ForceBridge on X.
2025-06-02
Magickbase pauses all ForceBridge bridge contracts and announces investigation. Stolen funds are laundered through Tornado Cash and FixedFloat.
2025-06-02
Magickbase publicly discloses $3.7 million in affected funds and announces cooperation with law enforcement and partner exchanges.
2025-06-02
Halborn Security publishes technical post-mortem attributing hack to access control failure, noting suspicious timing relative to sunset announcement.
2026-01-16
Extended deadline for user withdrawals from Force Bridge. Remaining funds to be held in Magickbase custody.
Decision Log
- hash: Ecdc34zsfGL6RpmgtihMaBFgFJVMga63SMzpD6YJrt1Z
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:23 AM
last updated: 5/27/2026, 8:21:10 PM
avoid.net — verified advice for a post-truth world